How to file a DPPA private right of action

A federal statute most cops don't know they own

Someone pulled your DMV record without a permitted reason. A private investigator, a stalker with a friend at a contractor, a marketing firm. You can sue them in federal court. The minimum award is $2,500 plus your attorney's fees. The statute is the Driver's Privacy Protection Act, a 1994 federal law that limits what state DMVs and downstream resellers can do with driver data.

Most officers don't know this exists. The law has teeth. The bar to file is lower than people think. Walk through it once and you'll know if you have a case.

What the DPPA actually does

The DPPA covers personal information that came from a state DMV. Name, address, photo, social, medical or disability info, and every field that flows out of vehicle and license records.

The statute lists 14 permitted uses for that data. Service of process. Insurance investigations. Court proceedings. Bulk research that doesn't identify you. A few others. If the use doesn't match one of the 14, the disclosure is unlawful.

The teeth are in 18 USC 2724. Anyone who obtains, discloses, or uses DMV-derived personal info for a purpose not permitted is liable to you. Liquidated damages of $2,500 minimum per violation. Plus actual damages if higher. Plus punitive damages for willful conduct. Plus attorney's fees and costs. That last part is what gets lawyers to take the case.

The elements you have to prove

Three pieces.

The data came from a state DMV. A skip-trace report that lists your registered vehicle, your driver's-license address, or any field DMVs uniquely produce is enough to anchor it. A broker page that pulled the same address from voter rolls and property records is not. The data has to trace back to motor-vehicle records.

Someone obtained, disclosed, or used it. Pulling the record counts. Reselling it counts. Using it to send marketing or to track a person counts. The statute is broad on the verb.

The purpose wasn't on the permitted-use list. This is the contested element. Defendants will argue their use fits one of the 14 carve-outs. Insurance investigation, court use, employer screening with notice, certain research. Read the list before you assume your case is clean.

How to gather evidence

Start with the artifact. The skip-trace report, the broker page, the email from a PI, the screenshot of a database query. Save it with a date and a URL. If you got it from a friend who showed you, get a copy.

Pull your own DMV abstract. Most states let you request a record of who pulled your file. Some call it a "request log" or "audit history." It's not always granted, but file the request and document the response. A log entry showing a non-government requester is gold.

Document your damages. The statute gives you the $2,500 minimum without proof of actual harm. But if you can show the unlawful pull caused harassment, swatting, lost income, or a move, the actual-damages number can be much higher. Save text messages, voicemails, the police report from any incident. Pattern of harassment after the pull is the kind of fact that drives settlement value.

Check whether the requester is a repeat player. PIs, marketing firms, and skip-trace companies often pull thousands of DMV records the same way. A class action sometimes makes more sense than a solo case. A plaintiff's-side data-privacy firm will know which targets have a track record.

Where to file

Federal court. The DPPA is a federal statute and federal courts have jurisdiction under 28 USC 1331. Pick the district where the defendant lives, where the unlawful act happened, or where you live and were harmed. Any of the three usually works.

Don't file in state court. Some states have analog statutes, but the federal DPPA is the primary tool. State versions piggy-back. Federal court also gets you the attorney-fee shifting provision in clean form.

Statute of limitations runs four years from when the cause of action accrued, under the federal catch-all in 28 U.S.C. § 1658. DPPA was amended after 1990, so the four-year default applies. Some circuits run the clock from discovery; others run it from the violation itself. If you found a 2023 skip-trace report in 2026, get to a lawyer fast either way. Memory and digital evidence both fade.

What damages look like in practice

The minimum award is $2,500 per violation. "Per violation" is the key phrase. Pulling your record once is one violation. Pulling it 12 times across two years is 12 violations. Reselling it to three downstream buyers is potentially three more.

Heads up on the split. Federal courts haven't agreed on what "per violation" means. Some circuits read it per-access. Each separate pull is its own $2,500 floor. Other circuits read it per-course-of-conduct. A whole pattern of pulls on one target collapses into a single $2,500 violation. The difference is enormous. A PI who ran your plate fifty times over a year is either a $125,000 case or a $2,500 case depending on the rule in your circuit. Your lawyer will know how the local circuit comes down. Ask before you file.

Punitive damages run on top of the statutory minimum when the defendant acted willfully or in reckless disregard. Courts have awarded punitives in the tens of thousands per plaintiff in DPPA cases. The famous Senne v. Village of Palatine ruling from the Seventh Circuit established that even routine, automated violations can trigger statutory damages, which is why class actions move the dollar amounts so fast.

Attorney's fees are separate from damages. The court orders the defendant to pay your lawyer's hours plus costs. This is what makes the case economical for plaintiffs' counsel even when the underlying damages are modest.

A real-world example

An officer in a Midwest department starts getting harassing texts. He runs his own scan and notices a recent DMV-derived skip-trace listing on his broker results. The pull traces back to a private investigator hired by a defendant in a case the officer worked.

The PI claimed an "investigation" use. The officer's lawyer argued the investigation was for a personal grudge, not a permitted DPPA purpose. State court and district court both held the use unlawful. The PI settled for $2,500 plus the officer's legal fees. Total cost to the officer: zero, because the fee-shift provision covered it.

The pattern repeats. Most cases settle inside a year. The leverage isn't the $2,500. It's the attorney fees that scale with how hard the defendant fights.

What this doesn't do

DPPA only covers DMV-derived data. It doesn't reach voter rolls, property records, court files, or commercial credit data. If your address showed up on Spokeo because your county recorded a deed in 2014, that's not a DPPA case. Different sources, different statutes.

DPPA doesn't force takedown. The lawsuit recovers damages. It doesn't compel the broker to remove your record from the live site. For takedown, you still need to file a broker opt-out request or, if you're in NJ, a Daniel's Law demand.

The case also doesn't reach federal officers' federal personnel records. Those flow through agency-side privacy regimes and the Privacy Act of 1974, not DPPA.

How this fits the broader stack

DPPA is the federal hammer for unlawful DMV disclosure. Most officers will never need it. Some officers will need it the day they discover their address has been pulled and sold to a problem.

Run a free scan to map what's currently exposed. If you find a DMV-derived listing, pull the record's audit log if your state offers one. Save the evidence. Talk to a privacy lawyer who's done DPPA work. The case files itself once you have the artifact.

For the broader cleanup, the opt-out request letter handles individual broker takedown. The state AG complaint template escalates when a broker ignores you. DPPA is the third tool in the stack. Use it when the disclosure was unlawful and someone has assets worth suing for.